rConfig 3.9.5 allows command injection by sending a crafted GET request to lib/ajaxHandlers/ajaxArchiveFiles.php since the path parameter is passed directly to the exec function without being escaped.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2021-08-09T22:54:16

Updated: 2024-08-04T14:58:14.381Z

Reserved: 2020-08-13T00:00:00

Link: CVE-2020-23151

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2021-08-09T23:15:06.997

Modified: 2024-11-21T05:13:36.423

Link: CVE-2020-23151

cve-icon Redhat

No data.